EKS Webhook Token Authentication: Difference between revisions

From NovaOrdis Knowledge Base
Jump to navigation Jump to search
No edit summary
 
Line 13: Line 13:
{{External|https://aws.github.io/aws-eks-best-practices/iam/#controlling-access-to-eks-clusters}}
{{External|https://aws.github.io/aws-eks-best-practices/iam/#controlling-access-to-eks-clusters}}
{{External|https://docs.aws.amazon.com/STS/latest/APIReference/API_GetCallerIdentity.html}}
{{External|https://docs.aws.amazon.com/STS/latest/APIReference/API_GetCallerIdentity.html}}
=Mapping the IAM Identity back to Kubernetes Identity=
{{Internal|Amazon_EKS_Operations#Allowing_Additional_Users_to_Access_the_Cluster|Allowing Additional Users to Access the Cluster}}


=Generate a Token=
=Generate a Token=
Line 30: Line 27:
aws eks get-token --cluster <cluster-name> --role <role-arn>
aws eks get-token --cluster <cluster-name> --role <role-arn>
</syntaxhighlight>
</syntaxhighlight>
=Mapping the IAM Identity back to Kubernetes Identity=
{{Internal|Amazon_EKS_Operations#Allowing_Additional_Users_to_Access_the_Cluster|Allowing Additional Users to Access the Cluster}}

Latest revision as of 01:28, 2 October 2020

External

Internal

Overview

EKS has native support for bearer tokens and webhook token authentication. The bearer token is the only piece of information that carries the identity of the caller to the Kubernetes server. It consists of a pre-signed URL that includes an Amazon credential and signature.

For more details:

https://aws.github.io/aws-eks-best-practices/iam/#controlling-access-to-eks-clusters
https://docs.aws.amazon.com/STS/latest/APIReference/API_GetCallerIdentity.html

Generate a Token

For the current IAM User, associated with the current AWS_PROFILE:

aws eks get-token --cluster <cluster-name>

For an arbitrary IAM role:

aws eks get-token --cluster <cluster-name> --role <role-arn>

Mapping the IAM Identity back to Kubernetes Identity

Allowing Additional Users to Access the Cluster